Small websites do not need exotic encryption systems, but they do need the fundamentals implemented correctly. For most public-facing sites, that starts with HTTPS, valid TLS certificates, secure cookies, sensible authentication and keeping software up to date.
Start with HTTPS everywhere
Use a valid TLS certificate for the main domain and every active subdomain. Free certificate services such as Let’s Encrypt can automate issuance and renewal. Redirect HTTP traffic to HTTPS and check that old or forgotten subdomains are not left exposed.
Do not confuse TLS with end-to-end encryption
TLS protects data while it travels between a browser and a web server. End-to-end encryption is a different architecture in which intermediaries cannot read the content. Most ordinary websites do not need to describe themselves as “end-to-end encrypted”.
Useful controls for a small site
- Maintain an inventory of domains and subdomains.
- Renew certificates automatically where possible.
- Use HSTS only after confirming HTTPS works consistently across the required hosts.
- Protect administrator accounts with strong authentication.
- Keep CMS, plugins, frameworks and server software patched.
- Review third-party services that receive personal or payment data.
The earlier version of this article cited unsupported claims that 45% of small-business leaks came from unsecured subdomains and that encryption reduced breaches by 60%. Those figures have been removed. Encryption is essential, but it is only one part of web security.
